com.lowagie.text.pdf

Class PdfPKCS7

public class PdfPKCS7 extends Object

This class does all the processing related to signing and verifying a PKCS#7 signature.

It's based in code found at org.bouncycastle.

Nested Class Summary
static classPdfPKCS7.X509Name
a class that holds an X509 name
static classPdfPKCS7.X509NameTokenizer
class for breaking up an X500 Name into it's component tokens, ala java.util.StringTokenizer.
Field Summary
static HashMapalgorithmNames
static HashMapallowedDigests
BasicOCSPRespbasicResp
Collectioncerts
Collectioncrls
byte[]digest
StringdigestAlgorithm
byte[]digestAttr
Setdigestalgos
StringdigestEncryptionAlgorithm
static HashMapdigestNames
byte[]externalDigest
byte[]externalRSAdata
static StringID_ADBE_REVOCATION
static StringID_CONTENT_TYPE
static StringID_DSA
static StringID_MESSAGE_DIGEST
static StringID_PKCS7_DATA
static StringID_PKCS7_SIGNED_DATA
static StringID_RSA
static StringID_SIGNING_TIME
Stringlocation
Holds value of property location.
MessageDigestmessageDigest
PrivateKeyprivKey
Stringprovider
Stringreason
Holds value of property reason.
byte[]RSAdata
Signaturesig
byte[]sigAttr
X509CertificatesignCert
CollectionsignCerts
CalendarsignDate
Holds value of property signDate.
intsignerversion
StringsignName
Holds value of property signName.
TimeStampTokentimeStampToken
booleanverified
booleanverifyResult
intversion
Constructor Summary
PdfPKCS7(byte[] contentsKey, byte[] certsKey, String provider)
Verifies a signature using the sub-filter adbe.x509.rsa_sha1.
PdfPKCS7(byte[] contentsKey, String provider)
Verifies a signature using the sub-filter adbe.pkcs7.detached or adbe.pkcs7.sha1.
PdfPKCS7(PrivateKey privKey, Certificate[] certChain, CRL[] crlList, String hashAlgorithm, String provider, boolean hasRSAdata)
Generates a signature.
Method Summary
ASN1EncodableVectorbuildUnauthenticatedAttributes(byte[] timeStampToken)
Added by Aiken Sam, 2006-11-15, modifed by Martin Brunecky 07/12/2007 to start with the timeStampToken (signedData 1.2.840.113549.1.7.2).
voidfindOcsp(ASN1Sequence seq)
static StringgetAlgorithm(String oid)
Gets the algorithm name for a certain id.
byte[]getAuthenticatedAttributeBytes(byte[] secondDigest, Calendar signingTime, byte[] ocsp)
When using authenticatedAttributes the authentication process is different.
DERSetgetAuthenticatedAttributeSet(byte[] secondDigest, Calendar signingTime, byte[] ocsp)
Certificate[]getCertificates()
Get all the X.509 certificates associated with this PKCS#7 object in no particular order.
CollectiongetCRLs()
Get the X.509 certificate revocation lists associated with this PKCS#7 object
static StringgetDigest(String oid)
Gets the digest name for a certain id
StringgetDigestAlgorithm()
Get the algorithm used to calculate the message digest
byte[]getEncodedPKCS1()
Gets the bytes for the PKCS#1 object.
byte[]getEncodedPKCS7()
Gets the bytes for the PKCS7SignedData object.
byte[]getEncodedPKCS7(byte[] secondDigest, Calendar signingTime)
Gets the bytes for the PKCS7SignedData object.
byte[]getEncodedPKCS7(byte[] secondDigest, Calendar signingTime, TSAClient tsaClient, byte[] ocsp)
Gets the bytes for the PKCS7SignedData object.
static DERObjectgetExtensionValue(X509Certificate cert, String oid)
StringgetHashAlgorithm()
Returns the algorithm.
static DERObjectgetIssuer(byte[] enc)
Get the "issuer" from the TBSCertificate bytes that are passed in
static PdfPKCS7.X509NamegetIssuerFields(X509Certificate cert)
Get the issuer fields from an X509 Certificate
StringgetLocation()
Getter for property location.
BasicOCSPRespgetOcsp()
Gets the OCSP basic response if there is one.
static StringgetOCSPURL(X509Certificate certificate)
Retrieves the OCSP URL from the given certificate.
StringgetReason()
Getter for property reason.
Certificate[]getSignCertificateChain()
Get the X.509 sign certificate chain associated with this PKCS#7 object.
CalendargetSignDate()
Getter for property signDate.
X509CertificategetSigningCertificate()
Get the X.509 certificate actually used to sign the digest.
intgetSigningInfoVersion()
Get the version of the PKCS#7 "SignerInfo" object.
StringgetSignName()
Getter for property sigName.
static StringgetStringFromGeneralName(DERObject names)
static DERObjectgetSubject(byte[] enc)
Get the "subject" from the TBSCertificate bytes that are passed in
static PdfPKCS7.X509NamegetSubjectFields(X509Certificate cert)
Get the subject fields from an X509 Certificate
CalendargetTimeStampDate()
Gets the timestamp date
TimeStampTokengetTimeStampToken()
Gets the timestamp token if there is one.
intgetVersion()
Get the version of the PKCS#7 object.
booleanisRevocationValid()
Checks if OCSP revocation refers to the document signing certificate.
static KeyStoreloadCacertsKeyStore()
Loads the default root certificates at <java.home>/lib/security/cacerts with the default provider.
static KeyStoreloadCacertsKeyStore(String provider)
Loads the default root certificates at <java.home>/lib/security/cacerts.
voidsetExternalDigest(byte[] digest, byte[] RSAdata, String digestEncryptionAlgorithm)
Sets the digest/signature to an external calculated value.
voidsetLocation(String location)
Setter for property location.
voidsetReason(String reason)
Setter for property reason.
voidsetSignDate(Calendar signDate)
Setter for property signDate.
voidsetSignName(String signName)
Setter for property sigName.
voidsignCertificateChain()
voidupdate(byte[] buf, int off, int len)
Update the digest with the specified bytes.
booleanverify()
Verify the digest.
static StringverifyCertificate(X509Certificate cert, Collection crls, Calendar calendar)
Verifies a single certificate.
static Object[]verifyCertificates(Certificate[] certs, KeyStore keystore, Collection crls, Calendar calendar)
Verifies a certificate chain against a KeyStore.
static booleanverifyOcspCertificates(BasicOCSPResp ocsp, KeyStore keystore, String provider)
Verifies an OCSP response against a KeyStore.
static booleanverifyTimestampCertificates(TimeStampToken ts, KeyStore keystore, String provider)
Verifies a timestamp against a KeyStore.
booleanverifyTimestampImprint()
Checks if the timestamp refers to this document.

Field Detail

algorithmNames

private static final HashMap algorithmNames

allowedDigests

private static final HashMap allowedDigests

basicResp

private BasicOCSPResp basicResp

certs

private Collection certs

crls

private Collection crls

digest

private byte[] digest

digestAlgorithm

private String digestAlgorithm

digestAttr

private byte[] digestAttr

digestalgos

private Set digestalgos

digestEncryptionAlgorithm

private String digestEncryptionAlgorithm

digestNames

private static final HashMap digestNames

externalDigest

private byte[] externalDigest

externalRSAdata

private byte[] externalRSAdata

ID_ADBE_REVOCATION

private static final String ID_ADBE_REVOCATION

ID_CONTENT_TYPE

private static final String ID_CONTENT_TYPE

ID_DSA

private static final String ID_DSA

ID_MESSAGE_DIGEST

private static final String ID_MESSAGE_DIGEST

ID_PKCS7_DATA

private static final String ID_PKCS7_DATA

ID_PKCS7_SIGNED_DATA

private static final String ID_PKCS7_SIGNED_DATA

ID_RSA

private static final String ID_RSA

ID_SIGNING_TIME

private static final String ID_SIGNING_TIME

location

private String location
Holds value of property location.

messageDigest

private MessageDigest messageDigest

privKey

private transient PrivateKey privKey

provider

private String provider

reason

private String reason
Holds value of property reason.

RSAdata

private byte[] RSAdata

sig

private Signature sig

sigAttr

private byte[] sigAttr

signCert

private X509Certificate signCert

signCerts

private Collection signCerts

signDate

private Calendar signDate
Holds value of property signDate.

signerversion

private int signerversion

signName

private String signName
Holds value of property signName.

timeStampToken

private TimeStampToken timeStampToken

verified

private boolean verified

verifyResult

private boolean verifyResult

version

private int version

Constructor Detail

PdfPKCS7

public PdfPKCS7(byte[] contentsKey, byte[] certsKey, String provider)
Verifies a signature using the sub-filter adbe.x509.rsa_sha1.

Parameters: contentsKey the /Contents key certsKey the /Cert key provider the provider or null for the default provider

PdfPKCS7

public PdfPKCS7(byte[] contentsKey, String provider)
Verifies a signature using the sub-filter adbe.pkcs7.detached or adbe.pkcs7.sha1.

Parameters: contentsKey the /Contents key provider the provider or null for the default provider

PdfPKCS7

public PdfPKCS7(PrivateKey privKey, Certificate[] certChain, CRL[] crlList, String hashAlgorithm, String provider, boolean hasRSAdata)
Generates a signature.

Parameters: privKey the private key certChain the certificate chain crlList the certificate revocation list hashAlgorithm the hash algorithm provider the provider or null for the default provider hasRSAdata true if the sub-filter is adbe.pkcs7.sha1

Throws: InvalidKeyException on error NoSuchProviderException on error NoSuchAlgorithmException on error

Method Detail

buildUnauthenticatedAttributes

private ASN1EncodableVector buildUnauthenticatedAttributes(byte[] timeStampToken)
Added by Aiken Sam, 2006-11-15, modifed by Martin Brunecky 07/12/2007 to start with the timeStampToken (signedData 1.2.840.113549.1.7.2). Token is the TSA response without response status, which is usually handled by the (vendor supplied) TSA request/response interface).

Parameters: timeStampToken byte[] - time stamp token, DER encoded signedData

Returns: ASN1EncodableVector

Throws: IOException

findOcsp

private void findOcsp(ASN1Sequence seq)

getAlgorithm

public static String getAlgorithm(String oid)
Gets the algorithm name for a certain id.

Parameters: oid an id (for instance "1.2.840.113549.1.1.1")

Returns: an algorithm name (for instance "RSA")

Since: 2.1.6

getAuthenticatedAttributeBytes

public byte[] getAuthenticatedAttributeBytes(byte[] secondDigest, Calendar signingTime, byte[] ocsp)
When using authenticatedAttributes the authentication process is different. The document digest is generated and put inside the attribute. The signing is done over the DER encoded authenticatedAttributes. This method provides that encoding and the parameters must be exactly the same as in (byte[],Calendar).

A simple example:

 Calendar cal = Calendar.getInstance();
 PdfPKCS7 pk7 = new PdfPKCS7(key, chain, null, "SHA1", null, false);
 MessageDigest messageDigest = MessageDigest.getInstance("SHA1");
 byte buf[] = new byte[8192];
 int n;
 InputStream inp = sap.getRangeStream();
 while ((n = inp.read(buf)) > 0) {
    messageDigest.update(buf, 0, n);
 }
 byte hash[] = messageDigest.digest();
 byte sh[] = pk7.getAuthenticatedAttributeBytes(hash, cal);
 pk7.update(sh, 0, sh.length);
 byte sg[] = pk7.getEncodedPKCS7(hash, cal);
 

Parameters: secondDigest the content digest signingTime the signing time

Returns: the byte array representation of the authenticatedAttributes ready to be signed

getAuthenticatedAttributeSet

private DERSet getAuthenticatedAttributeSet(byte[] secondDigest, Calendar signingTime, byte[] ocsp)

getCertificates

public Certificate[] getCertificates()
Get all the X.509 certificates associated with this PKCS#7 object in no particular order. Other certificates, from OCSP for example, will also be included.

Returns: the X.509 certificates associated with this PKCS#7 object

getCRLs

public Collection getCRLs()
Get the X.509 certificate revocation lists associated with this PKCS#7 object

Returns: the X.509 certificate revocation lists associated with this PKCS#7 object

getDigest

public static String getDigest(String oid)
Gets the digest name for a certain id

Parameters: oid an id (for instance "1.2.840.113549.2.5")

Returns: a digest name (for instance "MD5")

Since: 2.1.6

getDigestAlgorithm

public String getDigestAlgorithm()
Get the algorithm used to calculate the message digest

Returns: the algorithm used to calculate the message digest

getEncodedPKCS1

public byte[] getEncodedPKCS1()
Gets the bytes for the PKCS#1 object.

Returns: a byte array

getEncodedPKCS7

public byte[] getEncodedPKCS7()
Gets the bytes for the PKCS7SignedData object.

Returns: the bytes for the PKCS7SignedData object

getEncodedPKCS7

public byte[] getEncodedPKCS7(byte[] secondDigest, Calendar signingTime)
Gets the bytes for the PKCS7SignedData object. Optionally the authenticatedAttributes in the signerInfo can also be set. If either of the parameters is null, none will be used.

Parameters: secondDigest the digest in the authenticatedAttributes signingTime the signing time in the authenticatedAttributes

Returns: the bytes for the PKCS7SignedData object

getEncodedPKCS7

public byte[] getEncodedPKCS7(byte[] secondDigest, Calendar signingTime, TSAClient tsaClient, byte[] ocsp)
Gets the bytes for the PKCS7SignedData object. Optionally the authenticatedAttributes in the signerInfo can also be set, OR a time-stamp-authority client may be provided.

Parameters: secondDigest the digest in the authenticatedAttributes signingTime the signing time in the authenticatedAttributes tsaClient TSAClient - null or an optional time stamp authority client

Returns: byte[] the bytes for the PKCS7SignedData object

Since: 2.1.6

getExtensionValue

private static DERObject getExtensionValue(X509Certificate cert, String oid)

getHashAlgorithm

public String getHashAlgorithm()
Returns the algorithm.

Returns: the digest algorithm

getIssuer

private static DERObject getIssuer(byte[] enc)
Get the "issuer" from the TBSCertificate bytes that are passed in

Parameters: enc a TBSCertificate in a byte array

Returns: a DERObject

getIssuerFields

public static PdfPKCS7.X509Name getIssuerFields(X509Certificate cert)
Get the issuer fields from an X509 Certificate

Parameters: cert an X509Certificate

Returns: an X509Name

getLocation

public String getLocation()
Getter for property location.

Returns: Value of property location.

getOcsp

public BasicOCSPResp getOcsp()
Gets the OCSP basic response if there is one.

Returns: the OCSP basic response or null

Since: 2.1.6

getOCSPURL

public static String getOCSPURL(X509Certificate certificate)
Retrieves the OCSP URL from the given certificate.

Parameters: certificate the certificate

Returns: the URL or null

Throws: CertificateParsingException on error

Since: 2.1.6

getReason

public String getReason()
Getter for property reason.

Returns: Value of property reason.

getSignCertificateChain

public Certificate[] getSignCertificateChain()
Get the X.509 sign certificate chain associated with this PKCS#7 object. Only the certificates used for the main signature will be returned, with the signing certificate first.

Returns: the X.509 certificates associated with this PKCS#7 object

Since: 2.1.6

getSignDate

public Calendar getSignDate()
Getter for property signDate.

Returns: Value of property signDate.

getSigningCertificate

public X509Certificate getSigningCertificate()
Get the X.509 certificate actually used to sign the digest.

Returns: the X.509 certificate actually used to sign the digest

getSigningInfoVersion

public int getSigningInfoVersion()
Get the version of the PKCS#7 "SignerInfo" object. Always 1

Returns: the version of the PKCS#7 "SignerInfo" object. Always 1

getSignName

public String getSignName()
Getter for property sigName.

Returns: Value of property sigName.

getStringFromGeneralName

private static String getStringFromGeneralName(DERObject names)

getSubject

private static DERObject getSubject(byte[] enc)
Get the "subject" from the TBSCertificate bytes that are passed in

Parameters: enc A TBSCertificate in a byte array

Returns: a DERObject

getSubjectFields

public static PdfPKCS7.X509Name getSubjectFields(X509Certificate cert)
Get the subject fields from an X509 Certificate

Parameters: cert an X509Certificate

Returns: an X509Name

getTimeStampDate

public Calendar getTimeStampDate()
Gets the timestamp date

Returns: a date

Since: 2.1.6

getTimeStampToken

public TimeStampToken getTimeStampToken()
Gets the timestamp token if there is one.

Returns: the timestamp token or null

Since: 2.1.6

getVersion

public int getVersion()
Get the version of the PKCS#7 object. Always 1

Returns: the version of the PKCS#7 object. Always 1

isRevocationValid

public boolean isRevocationValid()
Checks if OCSP revocation refers to the document signing certificate.

Returns: true if it checks false otherwise

Since: 2.1.6

loadCacertsKeyStore

public static KeyStore loadCacertsKeyStore()
Loads the default root certificates at <java.home>/lib/security/cacerts with the default provider.

Returns: a KeyStore

loadCacertsKeyStore

public static KeyStore loadCacertsKeyStore(String provider)
Loads the default root certificates at <java.home>/lib/security/cacerts.

Parameters: provider the provider or null for the default provider

Returns: a KeyStore

setExternalDigest

public void setExternalDigest(byte[] digest, byte[] RSAdata, String digestEncryptionAlgorithm)
Sets the digest/signature to an external calculated value.

Parameters: digest the digest. This is the actual signature RSAdata the extra data that goes into the data tag in PKCS#7 digestEncryptionAlgorithm the encryption algorithm. It may must be null if the digest is also null. If the digest is not null then it may be "RSA" or "DSA"

setLocation

public void setLocation(String location)
Setter for property location.

Parameters: location New value of property location.

setReason

public void setReason(String reason)
Setter for property reason.

Parameters: reason New value of property reason.

setSignDate

public void setSignDate(Calendar signDate)
Setter for property signDate.

Parameters: signDate New value of property signDate.

setSignName

public void setSignName(String signName)
Setter for property sigName.

Parameters: signName New value of property sigName.

signCertificateChain

private void signCertificateChain()

update

public void update(byte[] buf, int off, int len)
Update the digest with the specified bytes. This method is used both for signing and verifying

Parameters: buf the data buffer off the offset in the data buffer len the data length

Throws: SignatureException on error

verify

public boolean verify()
Verify the digest.

Returns: true if the signature checks out, false otherwise

Throws: SignatureException on error

verifyCertificate

public static String verifyCertificate(X509Certificate cert, Collection crls, Calendar calendar)
Verifies a single certificate.

Parameters: cert the certificate to verify crls the certificate revocation list or null calendar the date or null for the current date

Returns: a String with the error description or null if no error

verifyCertificates

public static Object[] verifyCertificates(Certificate[] certs, KeyStore keystore, Collection crls, Calendar calendar)
Verifies a certificate chain against a KeyStore.

Parameters: certs the certificate chain keystore the KeyStore crls the certificate revocation list or null calendar the date or null for the current date

Returns: null if the certificate chain could be validated or a Object[]{cert,error} where cert is the failed certificate and error is the error message

verifyOcspCertificates

public static boolean verifyOcspCertificates(BasicOCSPResp ocsp, KeyStore keystore, String provider)
Verifies an OCSP response against a KeyStore.

Parameters: ocsp the OCSP response keystore the KeyStore provider the provider or null to use the BouncyCastle provider

Returns: true is a certificate was found

Since: 2.1.6

verifyTimestampCertificates

public static boolean verifyTimestampCertificates(TimeStampToken ts, KeyStore keystore, String provider)
Verifies a timestamp against a KeyStore.

Parameters: ts the timestamp keystore the KeyStore provider the provider or null to use the BouncyCastle provider

Returns: true is a certificate was found

Since: 2.1.6

verifyTimestampImprint

public boolean verifyTimestampImprint()
Checks if the timestamp refers to this document.

Returns: true if it checks false otherwise

Throws: java.security.NoSuchAlgorithmException on error

Since: 2.1.6